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MEMORANDUM FOR THE MEMBERS OF USIB 
SUBJECT: Industrial Security Program (U) 

1. -NSC ID No. 6 prescribes for COMINT and ELINT and 
their associated activities "an organisation and management which 
will . . . insure the necessary degree'of protection"; but it tfmits 
any wording easiLy construed as providing the necessary authority 
to prescribe security standards and safeguards for COMINT con- 
tracts awarded to industry on behalf of NSA. Accordingly, the NSA 
industrial security program is based largely on DOD Directive 

No. S-5100. 20, "The National Security Agency," dated 19 March 
1959. In Section IV, Paragraph 5, that directive specifies that, 
"within its assigned fields of responsibilities, " the Agency shall 
develop requisite security rules, regulations, and standards 
governing operating practices in accordance with the policies^ of. 
the U. S. Intelligence Board. In Section VI, Paragraph A. 6. , 
of the same directive, the Director, NSA, is specifically delegated 
authority to prescribe or review and approve security rules, ^regu- 
lations, and instructions "as appropriate. " A careful examination 
of the authorities cited above, and of some other directives stemming 
from the Secretary of Defense, leads to the conclusion that a-clarifi- 
cation by USIB of its policy concerning the release of COMINT to 
contractors is needed. While the existing directives do not expressly 
prohibit such release (but rather, by implication, encourage it), 
they do not make explicit provision for the handling of COMINT, infor- 
mation in non-governmental establishments. Therefore, while it is 
believed that the present program is consistent with the intent of 
Board policy, it is felt that there is a need for the Board to confirm 
this interpretation. 

2. Because of the necessity to utilize industrial potential in 
the pursuit of our COMINT effort, our industrial security program 
has been gradually developed -— in coordination with the Office of 
tiie Assistant Secretary of Defense (Manpower, Personnel and 
Reserve) and with Other agencies as appropriate. The Department 
of Defense has established a "cognizant security office" system to 
insure that all classified information in the Custody of a contractor 
is properly safeguarded. Because of its COMINT responsibilities, 
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NSA has undertaken, for each of its COMINT contracts, to assume 
the security responsibilities of the Department of Defense "cognizant 
security office" for that portion of the contractor's, facility being 
utilized on the COMINT contract. It is felt that such an approach, 
within the framework of the Department of Defense industrial 
security program, has certain advantages. Some of these ad- 
vantages are: 

a. The contractor as such can be held responsible 
for a violation of established security procedures. 

b. Action can be taken insofar as the contractor's 
facility clearance is concerned, if the contractor violates the 
prescribed security regulations. 

c. The contractor is in a position to have COMINT 
material in his possession, if this is necessary to meet the oper- 
ational requirements of the contract. 

3. At the present time, this Agency has certain contracts 
for which some degree of COMINT access has been considered 
requisite to fulfilling the contractual requirements. The contract 
management activities of this Agency authorize such access at a 
contractor's facility onLy when it is considered absolutely necessary 
to meet an operational requirement. For some other contracts, 
contractor personnel are given COMINT -related (but non-codeword) 
background information. It has been our experience that this is a 
realistic approach to the problem; and industry has willingly ac- 
cepted the security responsibilities associated with this type of 
procurement. 

4. It should be noted that in many cases, particularly where 
devices are being built for specific problems, COMINT information 
can be evidenced in some degree during design, development and 
construction, as well as testing prior to acceptance by the govern- 
ment. In some cases, moreover, even though COMINT information 
is not directly involved during these phases, the devices themselves 
have obvious COMINT overtones. In addition, it is felt that, in 
those contracts for which COMINT access is deemed essential, so'- 
called sanitization of the' COMINT material is a futile gesture. It 
has been our experience, in those cases where sanitization has been 
attempted, that the contractor employees directly invoLved are 
technically capable of inferring the COMINT underlying the sanitized 
version. The majority of the contractors, moreover, are generating 
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COMINT as a condition of the contract; and it would be difficult, 
if not impossible, to conceal this fact from them. It should also 
be noted, however, that all of the COMINT material, either 
furnished to or generated by the contractor, is accounted for by 
this Agency through an inventory and control system which includes 
verification by inspection. 



S. The nearest approach to a USIB policy statement in this 
area appears to be Paragraph 44 of DCID No. 6/3, which places 
"upon the Board member, or his properly designated representative, 
of that department or agency directing the project” the responsi- 
bility for determining the need-to-know of civilians under contract 
and employees and representatives of commercial firms and 
civilian research institutions which are to engage in technical or 
intelligence research or in manufacture of equipment for COMINT 
activities, as welL as personnel from non-member government 
departments or agencies involved in such pursuits. In lieu of the 
promulgation of a more comprehensive and explicit USIB policy 
statement, this paragraph, plus Paragraph 56 concerning indoctri- 
nation and Paragraph 77 concerning physical secur&gttrthrough 
control of access and dissemination, provide the only USIB-derived 
basis for the corresponding aspects of the NSA industrial security 
program. 



6. In brief, the NSA industrial security program 
to be consistent with the intent of current Board policy, 
requested that the Board endorse this/ii^prjpretatj — 
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L. H. FROST 

V ice Admiral, USN 
Director 
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cc: 




Reading File 

Legal Advisor 

PROD-03 

R/D 

SEC 

OPS (3) 



M/R: Largely self-explanatory. The NSA industrial security program 
has been developed within the framework of the DOD (OASD, ■ MF&R) 
industrial security program, and is believed to be consistent with the 
intent of current USIB policies. However, since DOD Directive 
No. S-5100. 20 requires that "within its assigned fields. of responsi- 
bilities, 11 NSA shall develop requisite security rules, etc. , in 
accordance with the policies of USIB, instant correspondence required 
to get USIB confirmation with respect to the NSA industrial security 
program (an area in which no comprehensive and explicit statement 
of USIB policy exists). This memorandum for the members of USIB 
prepared at direction of Director, NSA. Coordinated with and concurred 
in by Legal Advisor (Mr. Banner), SEC (Mr. Lewe), and PROD-03 
(Mrs. Brewer). Discussed with R/D (Mrs. Haig), who reported that 
Director, R/D, in general concurs in the wording of this memorandum, 
but that he believes the Director, NSA, has .adequate authority under 
existing directives. 




ROBERT H. DARB 
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